Palo Alto Networks PANOS

Palo Alto Networks PAN-OS is an enterprise-grade next-generation firewall operating system that provides comprehensive network security, traffic management, and policy enforcement capabilities. This data integration platform enables organizations to query and analyze firewall configurations, security policies, network address translation rules, and administrative metadata from their Palo Alto Networks firewall infrastructure.

Category	Network security
Direction	Query source
Sign-in	API Key, Username and Password
Query languages	SQLite
Tables	4
Query templates	19
Website	paloaltonetworks.com

Before you start

Huntbase can sign in to Palo Alto Networks PANOS with any of these methods: API Key, Username and Password. Pick one, create the credential in Palo Alto Networks PANOS, then keep it to hand for the Connect step.

API Key

PAN-OS API key used to authenticate to the firewall/Panorama endpoint.

1. On the firewall or Panorama, go to Device › Admin Roles and create an admin role profile for API access.
2. On the role's XML API tab, enable only the XML API features you need and leave the rest disabled.
3. Create a separate administrator account for API access and assign it this role.
4. Generate the API key with a POST request to https://<firewall>/api/?type=keygen, passing user=<user>&password=<password>. Copy the value of the key element in the response.

Username and Password

Username and password credentials for the PAN-OS endpoint. Ignored if an API key is set.

1. On the firewall or Panorama, go to Device › Admin Roles and create an admin role profile for API access. On its XML API tab, enable only the features you need.
2. Create a separate administrator account for API access and assign it this role.

Watch out for

• PAN-OS invalidates an API key when the user's password changes, the user is deleted, or the key lifetime expires. Generate a new key after any of these.
• If you enter an API key, the username and password are ignored.

For the vendor's own instructions, see PAN-OS API authentication.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Palo Alto Networks PANOS

1. Go to Connections and click New connection, or click New connection on the Palo Alto Networks PANOS product page.
2. On Product, pick Palo Alto Networks PANOS and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Palo Alto Networks PANOS lives:

Field	Required	Notes
Hostname	No	The hostname or IP address of the firewall or Panorama management interface.
Username	No
Request Timeout (seconds)	No	Defaults to 10 seconds. Raise it if the device returns many objects.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

API Key

Field	Required	Notes
API Key	Yes	Secret — not shown again after you save it.

Username and Password

Field	Required	Notes
Password	Yes	Secret — not shown again after you save it.

Query it

Once connected, Palo Alto Networks PANOS can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 4 tables listed below, alongside every other connected source.

Example: SQLite

List all address objects — Explore all address objects in your network, gaining insights into the various network entities and their configurations.

SELECT
  *
FROM
  panos_address_object;

Palo Alto Networks PANOS ships with 19 query templates. Find them in Library › Queries — see Query templates.

Tables

Palo Alto Networks PANOS adds 4 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 4 tables

Table	Contains
panos_address_object	Address objects in the PAN-OS endpoint.
panos_administrative_tag	Tag objects in the PAN-OS endpoint.
panos_nat_rule	NAT rules for the PAN-OS endpoint.
panos_security_rule	Security rules for the PAN-OS endpoint.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog